Last Updated: 21 September 2007
MASTER
INDEX of articles written, posted
online, or recommended by Alex Paterson
Most aircraft disasters are the result of inappropriate action or actions carried out by the pilots involved - a process euphemistically known as "pilot error". Whilst the term "pilot error" is often seized upon by airline management, aircraft manufacturers and government aviation safety authorities to shift the blame for the disaster entirely onto the relevant aircrew (who are usually dead), it is often a gross over simplification of a far more complex situation. 1
Aircraft disasters are invariably the result of a chain of events culminating in the disaster itself. Many of the factors involved are insignificant in their own right, but when combined with other nominally insignificant factors they can result in a chain of events in which the pilots involved become mentally overloaded and confused as to what is happening and they begin to carry out actions inappropriate for the situation at hand. 2
Poor aircraft system and cockpit design is often a significant causal factor as to why aircrew become confused and begin to mishandle the situation they find themselves in.
Investigations into aircraft crashes continually reinforce the fact that air safety is best served by having competent, well trained pilots operating relatively simple aircraft under the auspices of succinct Standard Operating Procedures (SOPs).
Unfortunately, aircraft manufacturers and the management of many airlines continue to ignore this fundamental truth. Attempts by some aircraft manufacturers, particularly Airbus, to automate their aircraft to the extent that they could be operated by inexperienced, poorly trained pilots are destined to fail. More disturbingly, the increased automation of the new generation of 'electric' jet has resulted in them becoming manifestly more complex than earlier jets and in the process have introduced a whole new raft of dangers associated with that complexity.
The following article briefly discusses some of the dangers inherent in poor aircraft design, euphemistically known in the aviation industry as "Pilot Traps".
'Pilot Traps' are hereby defined as cockpit or aircraft design features that tend to confuse pilots and 'sucker' them into making inappropriate decisions.
Readers are invited to agree with, disagree with, or seek clarification about any of the material listed below or make suggestions about any aspect of aircraft design they think should be included in any future updates of this article.
Alex Paterson (May 2000)
SITE INDEX
THE PHILOSOPHY OF GOOD AIRCRAFT DESIGN
SPECIFIC ASPECTS OF GOOD AIRCRAFT DESIGN
Keep
it short and simple. (KISS) Aircraft
systems and procedures need to be designed in such a way that they
are as simple as possible commensurate with the task required of
them. The design must reflect both good ergonomics
3
and a conscious effort to minimize 'pilot
traps.'
Air safety is best served by having competent, well trained pilots operating relatively simple aircraft under the auspices of succinct Standard Operating Procedures (SOP).
Airline safety is inextricably linked to the exercise of sound flight management and that is not possible unless pilots have a comprehensive understanding of their aircraft systems and performance and what is going on around them. In the initial confusion that always accompanies an unexpected inflight emergency, pilots are much more likely to remember how a system works and then how to safely manage the problem if the system itself is relatively simple. A complex system is far more likely to lead to an aircrew misinterpreting what is going on (i.e. a loss of situational awareness ) which in turn virtually ensures the aircrew will mishandle the situation confronting them. 4
Emergency drills should be kept as short and simple as possible. It is a fundamental truth that a two (2) step procedure presents twice as many chances to be mismanaged as a one (1) step procedure.
__________________________
Pilots'
eyes and their mental concentration
should be focussed on one of two places during critical phases of
flight such as takeoff and landing or during an inflight emergency -
those being on the flight instruments and/or out the cockpit window.
Aircraft systems and procedures (both normal and abnormal) that
require pilots to take their eyes away from either of these two
places at critical stages of flight are potential death
traps.
In the initial confusion associated with an unexpected inflight emergency, it is essential that both pilots confine their focus of attention to flying the aircraft, preferably up away from the ground. 5
This procedure requires both pilots to monitor their respective flight instruments, especially when in Instrument Meteorological Conditions (IMC). Once the aircraft's flight path has been stabilised (preferably going up), the attention of one pilot can then be diverted to address a specific task at hand, such as retracting the gear and flaps and/or dealing with the inflight emergency, whilst the other pilot continues to solely monitor the flight path of the aircraft. (i.e. one pilot continues to fly the aircraft) It is clear that under these circumstances there is very little opportunity for any meaningful crosschecking of an emergency drill in most two (2) crew cockpits, hence the need for either very simple aircraft systems and/or a flight engineer. 6
Some items requiring the pilot not flying (PNF) to momentarily take his/her eyes off the flight instruments are probably unavoidable. Retracting flaps and landing gear, for instance. However, the introduction of a host of distracting new items should be avoided. The requirement to continually reset the airspeed bug with each flap configuration change in modern 'glass cockpit' (EFIS) aircraft is a case in point. 7
Aircraft designers should be cognisant of this basic premise when designing cockpits. Most contemporary 'glass cockpits' fail to satisfactorily address this important issue with their Performance Data Computers (PDC), Navigation Computers and Crew Alert Systems (and their respective controls) all located down on the centre control panel between the pilots out of view of either the flight instruments or cockpit window.
Return
to 'Autothrottle' section of
article.
__________________________
All
aircrew actions must be monitored and/or
crosschecked. Safe airline operation is
predicated on all pilot actions, including emergency
procedures, being monitored and/or crosschecked by the other pilot
and/or the flight engineer. This is only really possible in a three
(3) crew cockpit or a very simple, well designed two (2) crew
cockpit.
NOTE: In the author's experience, the only two (2) crew jet cockpit that goes anywhere near to meeting the criterion of all aircrew actions being crosschecked and having aircrew continue to monitor their flight instruments during critical stages of flight, such as takeoff and landing, is the 40 year old DC9 cockpit and MD8x series aircraft. The current generation of two (2) crew Boeing and Airbus aircraft do not meet both these criterion, especially with respect to their engine fire drills.
__________________________
Feedback.
Ideally, pilots should receive feedback about aircraft response and
behaviour through at least two senses, if only for
confidence-inspiring redundancy. Sight and sound are the primary
senses, but tactile inputs and feedback (i.e. movement, feel and
response of controls and the aircraft) complement visual feedback and
as such are very important, especially in high workload situations in
which diverting one's visual attention away from primary tasks such
as monitoring flight instruments during an auto-land, is potentially
dangerous.
NOTE: The current generation of Fly by Wire (FBW) Airbus aircraft are potentially very dangerous because they do not provide pilots with any tactile feedback associated with the operation of their primary flying controls or engine power levers.
For more on this subject see the auto-throttle and flying controls sections below.
__________________________
Aircraft should be designed to facilitate what machines and humans each do best:
Humans
are poor at monitoring tasks because
monitoring (e.g. watching paint dry) is so boringly monotonous
the human mind tends to drift on to more interesting things. In
contrast, a machine can be designed to stolidly monitor a single
parameter for its entire life (e.g. an alarm clock).
__________________________
Machines
(computers) should be used to monitor
aircraft systems and pilot performance and provide audio and visual
alerts whenever specified parameters are exceeded. The increasing use
of computer-generated 'voices' to advise aircrews about problems or
when pre-defined parameters are being exceeded is a positive trend.
(e.g. Ground Proximity Warning System)
__________________________
Pilots
should make all of the operating
decisions
pertaining to a flight. Humans have a
remarkable capacity to swiftly assess and respond to rapidly changing
circumstances. This is their forte. Except in clearly defined
circumstances, such as an autoland procedure, computers should
not have primary control over an aircraft at critical stages
of flight such as takeoff and landing.
__________________________
Automation
should not be taken to the point where
pilots lose basic airmanship skills and are lulled into a false sense
of security about the infallibility of the 'machine'. Unfortunately,
many pilots (including the author) feel the crossover point may
already have been passed and as such we can expect a spate of
avoidable airline disasters over the next 20 to 30 years associated with
the widespread loss of basic flying skills amongst the next
generation of pilots and the attendant phenomenon of pilot
disassociation. Pilots of Airbus 'Fly by Wire' aircraft are
particularly susceptible to this insidious problem as the aircraft is
normally flown almost entirely in the equivalent of Boeing's 'Control
Wheel Steering' auto-pilot mode.
8
For more on this subject see the
auto-throttle
and flying
controls sections below .
__________________________
Computers
are aids to pilots, not their replacement.
At the present time there is no artificial man-made substitute
to having properly trained, competent pilots in the cockpits of
aircraft. All aircraft systems and computers should be designed as
aids to pilots, not as their replacement. Attempts by some aircraft
manufacturers and airlines to replace seasoned competent pilots with
minimally trained aircraft 'technicians' flying overly complex
'automatic' aircraft is a dangerous practice and will inevitably
result in avoidable aviation disasters.
9
The following items are listed in alphabetical order.
On approach and takeoff, the airspeed 'bug' should automatically re-set itself to the new minimum airspeed whenever the flap configuration is changed. A 'bug', just for the record, is a colored pointer which pilots set around the dial of their airspeed gauge as a reminder of important speeds &endash; such as initial takeoff climb out speed (V2) or minimum approach speed for landing (Vref). In current aircraft (May 2000), any flap configuration change requires at least one pilot to manually reset the airspeed 'bug' using figures obtained from their memory.
The 40 year old DC9 aircraft had such an automatic system, albeit analogue, associated with the autothrottle on approach to land. The approach speed 'bug' on the airspeed indicator, received its signals from the angle of attack vane and was set automatically with each change of flap configuration. It was an elegantly simple system.
A modern digital equivalent could be designed
to set the bug at the minimum Vref (manoeuvring speed) for a
particular flap configuration, with a knob allowing pilots to quickly
dial in a "speed additive" over and above the minimum Vref speed
schedule calculated by the aircraft computers.
(see fig.
3 below )
_____________________________
All fixed-wing flying is closely related to Angle of Attack (AoA). Surprisingly, there is no instrument in the cockpit providing this information directly to pilots, even though all airliners have an Angle of Attack vane located outside the airplane and angle of attack information is fed to the aircraft flight computers and anti-stall system (e.g. the stick-shakers). Whilst angle of attack can be inferred indirectly from the airspeed indicator, it is predicated on pilots having accurate knowledge of the weight of their aircraft, something that most pilots know through 'feel' and performance degradation is often incorrect. If nothing else, an angle of attack instrument would help pilots determine whether or not their aircraft is overloaded. There are many pilots who learned to fly by Angle of Attack (AoA) in the military and their initial reaction to the absence of an AoA indicator in an airliner cockpit is a mixture of amazement and dismay. These pilots believe that several fatal airline crashes could have been prevented if the pilots involved had just had accurate information about their angle of attack and how hard they could pull back the control column without stalling the airplane (or if the shuddering they were encountering was Mach buffeting at high altitude).
It is the author's opinion that an AoA
instrument should be located next to or directly below the Airspeed
Indicator. (see fig.
1 below )
Apart from providing pilots with a direct indication of how close an aircraft is to the stall angle (stall protection), an Angle of Attack (AoA) instrument can also be used for many performance applications such as:
Source: Gary Williams (email: gww@pacific.net.sg)
_____________________________
In theory, many automatic features such as autospoilers are an excellent aid to pilots. However, the problem with them is that they tend to deskill pilots about the system that has been made automatic and have the potential to fail and let pilots down at the worst possible time, and because they usually work so reliably most of the time their failure usually goes unnoticed in the heat of the moment. This is an insidious problem which defies easy answers (except perhaps to dispense with many of them) and for this reason many pilots (including the author) are somewhat sceptical of anything that has 'auto' in its name.
Operating spoilers manually on landing soon becomes a reflex action to any competent pilot (and a satisfying one at that). It is the author's personal opinion that autospoilers are more trouble than they are worth and can be potentially very dangerous when they don't automatically deploy, as American Airlines Flt 1420 crash at Little Rock on 1st June 1999 demonstrated.
NOTE: Many pilots may not agree with the author's opinion on this issue.
Be that as it may, autospoilers are here to stay whether pilots like them or not. To ensure their safe operation, the said system should:
_____________________________
The throttle levers should physically move in response to power changes initiated by the autothrottle system. This feature provides both tactile feedback to the pilot flying (whose hands should be on the throttle levers during critical stages of flight anyway) as to what the engines are doing, as well as providing better visual reinforcement to both pilots when their hands are not on the throttles. Pilots are more likely to notice a throttle lever moving than changes to numbers spinning up and down on a digitized engine instrument. The Airbus design features non-moving throttle levers and as such does not meet this criteria.
NOTE: Airbus engineers claim that the non-moving throttle lever is only intended to indicate the throttle setting commanded by the pilot and that the engine instruments provide pilots with information as to what the engines are actually doing. This design philosophy completely goes against a basic premise of good airmanship whereby the eyes (and attention) of both pilots should be focussed on their flight instruments and/or looking out the cockpit windows at critical stages of flight such as takeoff and landing and should not be looking at engine instruments. For want of electric motors to move the throttle levers an aircraft could be lost. Whatever the airplane is doing should be intuitively apparent to its master at all times.
For more on this subject see 
'Pilot
Eyes' section above and the
Flying
Controls section below
Return to
'Feedback' section of article above
Return
to 'Automation' section of
article above
_____________________________
Normal flight operations checklists are best served by a mechanical "shopping list" device located on top of the glareshield. (i.e. above the autoflight mode control panel, refer to Fig. 3) The advantages are numerous:
By contrast, electronic checklists generally are located at the bottom of the center instrument panel, requiring pilots to look down into the cockpit at crucial times, such as during the approach to land. Indeed, the lower center-panel location can be dangerous even when the airplane is taxiing - as evidenced by the case of a jet that collided with a truck in the terminal area partly due to the fact that the pilots were performing the checklist at night whilst taxiing to the gate.
_____________________________
Checklists
- Abnormal/Emergency
Emergency checklists (Recall items) are best carried out using dedicated, 'emergency' books (e.g. Red cover) located next to each flight crew station. The checklists should use large print designed to be read at night in poor light or a smoke filled cockpit. All emergency drills should be as simple as possible.
Abnormal items checklist (i.e. Reference items) should be listed by system in a separate book (e.g. Yellow cover) located at each crew station.
Performance Data should be located in a separate Quick Reference Handbook (QRH) and/or plasticised card.
The advantages of performing emergency/abnormal checklists from dedicated thin plasticised books include:
By contrast, contemporary electronic emergency checklists (EICAS) tend to 'fracture' pilots' focus of attention as they require pilots to look down into cockpit to read the EICAS checklist located on the centre Engine Instrument Panel then back up to the overhead panel to where most system switches are located. The process of looking down, then up has the potential to contribute to pilot misinterpretation and mis-selection of switches etc and also can lead to pilot disorientation and vertigo, especially when performed in cloud at night. 12
NOTE: Boeing's Quick Reference Handbook (QRH) is a confused mess as it contains emergency items, abnormal items, some performance data and some normal check lists. In the opinion of the author, it is a jack of all trades and a master of none.
_____________________________
Electrical
Fire and the case for a 'Virgin' Electrical Bus
Most jet transport aircraft are very poorly designed with regard to the protection, detection and effective handling of in-flight electrical fires, as the Swissair Flight 111 crash off Nova Scotia on 2nd September 1998 tragically demonstrated.
This situation is exacerbated by the widespread use in aircraft of a potentially dangerous electrical wire product called 'Kapton' 13 and the fact that the current generation of airline jet transport aircraft (i.e. Airbus A320, A330, A340 and Boeing B777, MD11) are virtually unflyable without electricity, unlike earlier generation jets such as the DC9 and B737.
VIRGIN ELECTRICAL
BUS
Inflight electrical fire would be best handled by the
installation in aircraft of a completely separate ('Virgin') standby
electrical wiring system which would receive its power from the
Aircraft Battery and/or Air Driven Generator (ADG) and which would be
used in the case of an in-flight electrical fire to power essential
aircraft items normally available under Standby Electrical power.
(i.e. those items normally located on the Standby Electrical Bus, Hot
Battery Bus and Battery Bus)
In normal operation, the Virgin Electrical wiring system would remain unpowered.
In the event of a suspected electrical fire, the aircrew would simply pull a suitably located (and ideally, illuminated) 'ELECTRICAL FIRE' Handle (a one item drill) which would do the following things:
Clearly the Virgin Bus proposal needs much design work to take into account numerous engineering considerations such as:
NOTE 1: As of December 2000, no jet transport aircraft currently in production complies with the US Federal Aviation Regulations (FAR 25) pertaining to electrical system redundancy in the event of an electrical fire or arc tracking event. 16
NOTE 2: As of December 2000, no
jet transport has an effective strategy in place to deal with an
inflight electrical fire as evidenced by the current Boeing B777
electrical fire drill which simply instructs the aircrew to "Remove
Power" from the effected circuit without providing them with any
instructions as to how they should actually identify the affected
circuits or remove power from the same. As a minimum requirement, an
aircraft electrical fire drill should instruct aircrew to configure
the aircraft on Standby Electrical Power in order to remove as much
electricity from the aircraft electrical system as
possible. 17
COMMENT: In Australia we have a non alcoholic drink called 'Claytons'
TM , which is advertised by its manufacturers as "the
drink you have when you are not having a drink". In the author's
opinion, the Boeing Electrical Fire drill is a 'Claytons' emergency
drill - the drill you have when you don't have an effective strategy
to deal with the situation.
CONCLUSION:
As mentioned earlier, the current generation of jet aircraft such as
the Boeing B777, Airbus and MD11 cannot be effectively flown
without electricity, unlike earlier generation jets such as the DC9.
If a person had an electrical fire in their house, the first thing
that person would do is disconnect the electrical power to the house
by pulling the fuses, but this option is not available with aircraft
like the B777 and Airbus. The aircraft industry as a whole - that is
aircraft manufacturers, aviation regulators, airlines and pilots -
have failed to adequately address the problem of inflight electrical
fire and are simply burying their collective heads in the sand about
the issue. The concept of a Virgin Electrical Bus is a significant
step towards providing a solution to this complex problem.
For more on this issue see:
_____________________________
An engine fire is potentially the most acute inflight emergency facing pilots, particularly if it occurs during takeoff right at the moment of liftoff. Immediate action is often critical, especially if the fire warning is accompanied by a badly vibrating, disintegrating engine. For this reason, 'ENGINE FIRE' warning handles should be located on the forward instrument panel, just above the engine instruments, well within the peripheral vision of both pilots monitoring their flight instruments. (see Fig. 3)
The drill itself should be very simple - the manipulating pilot, on confirmation from the support pilot, should only be required to pull the illuminated fire handle to cutoff fuel to the engine (both at the engine and the tank) and twist it to activate the fire extinguisher. Pulling the fire handle should automatically silence the fire warning bell (if it hasn't already been silenced by the support pilot) and disconnect the auto-throttle.
Locating fire handles either in the overhead panel or on the center pedestal between the pilots requires both pilots to take their eyes off their flight instruments and turn their heads, with the attendant risk of both pilots developing spatial disorientation (vertigo) and leaving no-one monitoring the flight path of the aircraft whilst the drill is being carried out. This potentially dangerous situation is further exacerbated by the fact that current engine fire drill of most jet transport aircraft requires the pilot flying the aircraft to:
In other words, a four (4) item drill, presenting the aircrew with four (4) opportunities to get it wrong (i.e. four pilot traps), as opposed to the one (1) item drill proposed by the author.
NOTE: The DC9/MD80 series aircraft are a good example of well designed aircraft with regard to Engine Fire Warning and drill. The Engine Fire Handles are located on the forward instrument panel, just above the engine instruments and well within the peripheral vision of both pilots monitoring their respective flight instruments. The drill itself is essentially a one item drill - the pilot flying places his hand on the illuminated red handle and on confirmation by the support pilot pulls it to cutoff the fuel at the engine (amongst other things) and then twists it to discharge the extinguisher.
_____________________________
On most jet transport aircraft an engine failure is accompanied by a plethora of normally unrelated warning lights associated with the engine failure, such as Generator failure, Electrical Bus failure, Engine Hydraulic Pump failure, low Engine Oil Pressure, low Constant Speed Drive (CSD) oil pressure etc. In the confusion that often accompanies an inflight emergency, this cascade of warning lights has the potential to add to pilot confusion due to information overload. This confusion could be considerably reduced by the installation of specific 'ENGINE FAILURE' warning lights co-located with their respective 'Engine Fire' warning handles on the forward instrument panel, just above the engine instruments and well within the peripheral vision of both pilots monitoring their flight instruments. (see: Engine Fire Warning item above)
'ENGINE FAILURE' warning lights co-located with their respective 'Engine Fire' warning handles on the forward instrument panel provide an unambiguous means of identifying a badly vibrating and/or disintegrating engine that has not been accompanied by an engine fire warning, but which needs to be promptly secured by pulling the respective fire handle to prevent the disintegrating engine hurling debris into an adjacent engine or aircraft wing where the fuel tanks are located. 18
NOTE: Boeing have introduced such a light in their current generation of aircraft.
_____________________________
Flight
Instrument Design - Analogue versus Digital
The advent of the modern 'glass cockpit' (i.e. EFIS) has certainly revolutionised the amount of information and way it is presented to pilots and much of this change is positive. That said, designers are at a risk of throwing out the baby with bath water with regards to some aspects of cockpit design. A case in point is the Airspeed Indicator.
Many 'glass cockpit' (EFIS) aircraft such as the B777 have dispensed with round analogue Airspeed and Altimeter gauges in preference for digital vertical 'tape' presentations as an integral part of the Primary Attitude Director Indicator (ADI). Whilst such an arrangement may be appropriate for an Altimeter, it is not appropriate for an Airspeed Indicator. Round analogue gauges arcing through 270 degrees provide an instantly noticeable 'picture' with regard to airspeed. This is especially important with regard a sudden decay in airspeed associated with windshear. The actual airspeed 'numbers' themselves are fairly irrelevant; it is the position of the airspeed indicator needle in relation to the orange datum 'bug' that is important.
The assertion by aircraft manufacturers that the presence of windshear is adequately covered by the Speed Trend Indicator now installed in EFIS cockpits entirely misses the point. To many pilots (including the author) a Speed Trend Indicator has become just another indicator requiring additional attention and interpretation and as such has the potential to distract pilots from monitoring the really important primary flight instruments such as the Attitude Indicator, Airspeed Indicator, Altimeter and the Course Indicator on the HSI. The Speed Trend Indicator is simply not needed on an aircraft with a large round Airspeed Indicator, as any speed decay is instantly noted out the corner of the eyes of a competent pilot as he/she scans the rest of the flight instruments.
The same applies to most engine instruments. In many cases the actual 'numbers' on the gauge are irrelevant; it is where the needle pointer is in relation to some datum point, be it an orange 'bug' on an airspeed gauge or a red line section on an oil pressure gauge, that is important. This information needs to be instantly noticeable and not require the reading and interpretation of digital numbers spinning up and down.
_____________________________
Flight
Controls - Airbus sidestick versus conventional control
column
The 1989 introduction of the Airbus A320 witnessed a novel departure from the design concepts of previous civilian jet transport aircraft. Whilst many airline people (including some pilots) were enamoured by the originality of the design, a significant number of pilots (including the author) were sceptical of the design and a decade of service has done nothing to allay that scepticism. The A320 sidestick control is a case in point.
With the introduction of the 'sidestick', Airbus dispensed with the conventional control column normally located between the legs of pilots, arguing that it obstructed pilots' view of the flight instrument panel. Whilst this is true of a poorly designed control column, such as those installed in Boeing B727 and B737 aircraft, a well designed control column does not obstruct pilots' view of the flight instrument panels. There are plenty of examples of aircraft currently flying in which the control column does not obstruct the view of the flight instrument panel, for example the B767, B777, DC9, MD 8x etc.
By dispensing with the conventional control column, Airbus have broken a number of design rules fundamental to aircraft safety and in the process introduced a series of design features which adversely affect aircraft safety.
NOTE: The A320 is controlled by seven (7) flight control computers. As each computer fails or falls into disagreement with the majority, it is 'cauterized' by the remaining computers. Each computer failure is accompanied by subtle changes in the 'laws' under which the remaining computers continue to operate. In essence, the A320 presents pilots with seven (7) different aeroplanes depending on the level of computer degradation being experienced. Failure of A320 electric and hydraulic systems renders the aircraft unflyable. Juxtapose this situation with a 40 year old DC9 aircraft which has suffered a complete loss of electrics and hydraulics; - in manual reversion the aircraft still handles and feels virtually the same as a fully functioning aircraft and as such is fully controllable.
Return to
'Feedback' section of article
Return
to 'Automation' section of article
Return
to 'Autothrottle' section of
article
_____________________________
Performance
Data Computer (PDC)
Performance Data Computers (PDC) certainly have a place in long haul jet aircraft because of the wide variation in weight and consequent change to performance attributes of long haul aircraft between takeoff and landing 12 or more hours later.
However, a PDC is of little use in a shorthaul jet because all the information that can be obtained from it, - such as 'bug' speeds, optimum cruise levels and descent points, - can be easily obtained from a plasticised card located in the each crew station pocket. Further, most performance information should be in the head of a competent short haul pilot anyway. The two things that would be of use to shorthaul pilots from a PDC (especially in remote areas such as the Pacific Basin and Africa) - namely the Point of No Return (PNR) and Critical Point (CP) - are not available despite the fact that all the information to perform such a calculation is available to the PDC!
Like much of the electronic 'gadgetry' being foisted upon pilots, the PDC tends to deskill pilots by encouraging them to dispense with 'ball park figures' in their head and blindly trust the computer instead. At the same time the existence of a PDC encourages pilots to bury their heads down in the cockpit tapping away on a computer when they could be better employed looking out the window for terrain, weather or other traffic and/or monitoring their flight instruments.
In summary, the PDC is an unneeded, potentially dangerous distraction to pilots in shorthaul aircraft. 9
_____________________________
As with a moving autothrottle, a spinning stabilizer trim wheel provides pilots with an unmistakable alert as to a runaway stabilizer (especially on the B727/B737, which can spin pretty rapidly). A wheel also has the advantage of allowing pilots to physically grab hold of it in the event of a runaway trim situation. This arrangement at least gives pilots a few seconds to collect their thoughts and remember just where the stabilizer trim cutout switch is located. (Pilots often forget the location of seldom-used items in the initial confusion of an unexpected emergency) Finally, having secured the runaway trim, the aircraft can then be re-trimmed manually.
The lack of a manual trim wheel on some modern jets is a serious design flaw. These jets include the DC9 and stretched descendants like the Alaska Airlines MD83 that crashed off the Californian coast on 31 January 2000, and in which a runaway stabilizer trim situation was involved. The airplanes without trim wheels feature an aural alert, which emits a "barp" sound with each half-degree of stabilizer trim movement. A poorly trained pilot could easily misinterpret the sound, whereas a moving trim wheel spinning against one's knee is intuitively obvious to just about anyone.
_____________________________
The Artificial Horizon or Attitude Director Indicator (ADI) is the central pivot, as it were, of instrument flying and all adjustments to flight attitude are made using this primary 'control' instrument. Everything else is a performance instrument (Power + Attitude = Performance). Because of its importance, most transport aircraft are equipped with a Standby (backup) Attitude Indicator (AI) which, in case of generator failure is connected to standby battery power.
Because of its 'pivotal' importance, the Standby AI should be located within the normal instrument scan of at least the captain so that a failure of the primary ADI will be noticed immediately. Such is the arrangement on the B767. (see Fig. 3) The standby AI is located just to the right of the captain's normal instrument scan. (although it is not located in the best position available; see Standby Instruments section below) This is not the case on most other aircraft. For example, on the MD11 the Standby AI is located at the bottom right center of the instrument panel well away from the normal instrument scan of either pilot.
The twinning of the primary ADI and its backup should be a "sine qua non" 19 of good cockpit design. Pilots suddenly forced to adjust their accustomed selective radial scan and fly totally off of a remote 'peanut gyro' are already halfway to an unrecoverable unusual attitude. If the airplane is on fire and smoke is rapidly filling the cockpit, the need for pairing of primary and backup ADI is all the more apparent. An anxious pilot, with restricted peripheral vision, should not have to try to peer through smoke goggles at the backup horizon located on the lower edge of the center instrument panel. For another thing, a failed ADI is always going to remain centrally in the pilot's natural instrument scan as a potential 'fatal distraction.'
_____________________________
All transport aircraft should have at least one set of standby flight instruments located directly above, or next to, their primary counterparts on the Captain's flight instrument panel so that they fall within the normal instrument scan of the captain and any discrepancies can be instantly noticed. (see fig 1 below) This set of standby flight instruments should consist of a:
Fig. 1
In the case of EFIS cockpits, it is "sine qua non" of good cockpit design that any failure of the Primary ADI must result in the ADI screen going blank so as not to become a 'fatal distraction' to pilots. Aircraft in which the ADI screen also incorporates the Primary Airspeed Indicator and Primary Altimeter (as vertical 'tapes' either side of the ADI presentation) should have their standby counterparts clustered around the edges of the screen as depicted in figure 2 so as to provide both confidence inspiring verification as to the reliability of the primary instruments as well as an easy means to transition from the primary instruments to their standby counterparts in event of a primary instrument failure.
Each electronic screen should also have a clearly defined ON/OFF switch located on it to enable pilots to manually turn them OFF in the event of the screen providing suspect information. 21
Improving on a Basically Good Cockpit Design
B767-200
Shown above is a schematic of the instrument panel on the B767-200, which the author believes has the basic elements of good cockpit layout. However, I have added a number of significant improvements:
Return
to article at 'Airspeed
Bug' section
Return
to article at 'Checklists
- Normal' section
Return
to article at 'Engine
Fire' Section
Return
to article at 'Standby
Attitude Indicator' section
There is an adage going back over century which states that "those who design machines rarely use them" and that would appear to be very true with regard to aircraft.
As can be gleaned from the preceding information, minimizing 'pilot traps' through better aircraft design touches on a much larger question: who's driving the bus? Are aircraft designers giving pilots what they need, or what they think the pilots should have? In the author's opinion, it is about time aircraft manufacturers started to listen to what airline pilots have to say about aircraft design and implement the design features airline pilots want instead of imposing upon them overly complicated, poorly thought out features designed by non-pilots.
Alex Paterson (June 2000)
1. Accidents: Most aircraft crashes are incorrectly portrayed in the media as "accidents". By definition, an accident is "an unforeseen chance event resulting in injury". (Source: Macquarie Dictionary) The key word is "unforeseen". In modern aviation most "chance events" have been "foreseen" and equipment and procedures designed to manage these adverse sets of circumstances in a safe manner should have been put in place by aircraft manufacturers and airline management and aircrew properly trained in the use of the said equipment and procedures.
See: EXTERNAL FACTORS CONTRIBUTING TO AIRCRAFT DISASTERS by Alex Paterson (incomplete)
__________________________
2. Pilot confusion is known colloquially in the aviation industry as a "loss of situational awareness".
__________________________
3. Ergonomics is defined as the science of matching humans to the machines they work with. Good ergonomics takes into account the strengths of human beings, such as their ability to instinctively assess and deal with a rapidly changing situation. Good ergonomic design recognises humans are fallible and are very poor at monitoring tasks (because monitoring is so boring) whereas a properly designed machine (such as a computer) can be excellent at monitoring tasks. By definition, sound ergonomics is predicated on matching the abilities of machines to its human operator in a manner which is intuitively obvious to the human mind. In other words, the machine should be intuitively simple for a human to operate.
__________________________
4. So often, the last thing heard on the cockpit voice recorder (CVR) is "What's it doing now?"
__________________________
5. The only exception to this 'rule' is an aircraft decompression and/or cockpit smoke, in which case the oxygen masks of both pilots must be donned immediately.
__________________________
6. Flight Engineers: The next generation of four (4) engine long haul Very Large aircraft (600 passengers) will by necessity be relatively complex and as such should include a flight engineer as part of the cockpit crew.
See: 'The Case for a Flight Engineer in Long Haul Aircraft' by Alex Paterson (incomplete)
NOTE: Safe airline operation is predicated on all pilot actions, including emergency procedures, being monitored or crosschecked by either the support pilot and/or flight engineer. This is only possible in a three (3) crew cockpit or a very simple, well designed two (2) crew cockpit. In the author's experience, the only two (2) crew jet cockpit that goes anywhere near to meeting this criteria is the 40 year old DC9-30 cockpit. (and possibly the MD8x series) The current generation of two (2) crew Boeing and Airbus aircraft do not meet this criteria, especially in regard to inflight Engine Fire and inflight Electrical Fire.
__________________________
7. 'Glass Cockpit' is a euphemism for Electronic Flight Instrument System (EFIS) cockpits which use computer screens to display information. Computer screens are increasingly being used in aircraft to replace mechanical analogue gauges because:
The main negative aspect of EFIS is that it is encouraging cockpit designers to provide too much information for pilots to assimilate associated with information overload. Aircraft designers should provide pilots with what pilots) say they need, and not what designers think pilots should have.
Return to
article at 'Pilots
Eyes' section
Return
to article at 'Flight
Instrument Design' section
__________________________
8. Automatic Devices: A little discussed aspect of automatic devices is that, apart from deskilling pilots, they invariably tend to degrade the actual experience of being a pilot. Most pilots (but not all) actually get significant enjoyment out of manually flying their aircraft and the response (feedback) they receive from an aircraft. It is the conviction of the author, that experience is 'raison d'etre' (reason for) human existence and denying humans the opportunity to experience things for no good reason is destructive to the spirit. If nothing else it is significant reason why so many pilots dislike Airbus aircraft. Airbus have completely lost sight of the dehumanising aspect of auto items and the deleterious aspects of that state of affairs, whereas Boeing would appear to have embraced the importance of allowing pilots to experience the magic of flying with the B777. As an A320 pilot once quipped to the author; "there is no magic flying an A320, when it's all said and done it is a rather empty experience." Any airline that ends up with a substantial percentage of its pilots with that attitude towards their aircraft is asking for trouble because a bored, complacent pilot is a dangerous pilot.
__________________________
9. Blindly Following the Computer. For more on the dangers of blindly following the computer see:
Return to
article at 'Computers
are Aids to Pilots' section
Return
to article at 'Checklists
- Abnormal/Emergency' section
Return
to article at 'No
Tactile Feedback when hand flying'
section
Return
to article at 'Performance
Data Computer' section
__________________________
10. Angle of Attack Gauge: The loss of AeroPeru Boeing 757 (flight 603) on 2nd October 1996 is a case in point. The pilots of this aircraft lost control of it whilst attempting to fly it at night using erroneous airdata information. The airspeed and altimeters were presenting incorrect data because the aircraft's static ports had been taped over by maintenance crew and no-one had noticed it prior to takeoff. There is little doubt that had this aircraft been fitted with an Angle of Attack (AoA) instrument, and the aircrew trained in its use, it would have provided confirmation for them to ignore the airdata instruments and trust their Attitude Director Indicators. As such, this incident was survivable.
__________________________
11. Positive Verification Checks: A positive verbal verification check protocol whereby the support pilot checks that something has occurred and then makes an announcement to that effect (e.g. "spoilers deployed") has two (2) distinct advantages over a negative silent check in which the support pilot only makes a callout if something has not occurred. Those advantages are:
It is for these reasons that most airlines dispensed with silent checks nearly thirty (30) years ago and replaced them with the 'challenge and response' type check list.
__________________________
12. EICAS - Engine Instrument and Crew Alert System. Aircraft manufacturers should consider splitting the functions of the EICAS screen into their separate functions, with the Engine Instrument screen remaining in its present position on the centre forward instrument panel and the Crew Alert System screen being moved to the bottom of the centre overhead panel just above the windscreen (i.e. in the same position as the DC9/MD8x Annunciator Panel). Such a location affords to two (2) distinct advantages:
__________________________
13. For more on Kapton wire see:
__________________________
14. Arc-Fault Circuit Interrupters (AFCI): There are significant design constraints facing the concept of AFCI circuit breakers for aircraft, not in the least being the likelihood of high frequency attenuation associated with the long lengths of wire in aircraft. Because of these design problems, most aviation electrical experts don't expect to see reliable AFCI circuit breakers in aircraft prior to 2005.
__________________________
15. Ground-Fault Circuit Interrupter (GFCI) circuit breakers. GFCI are acknowledged by most electrical experts to be the best way to protect electrical wires, as well as provide some protection to electronic and electrical components themselves, something the current generation of thermal trip circuit breaker cannot provide. However, GFCI require the installation of individual neutral return wires, something which are not utilised in the current generation of jet transport aircraft due to the extra weight of such wires. The current generation of jet transport aircraft use the airframe as the return path of electrical current to save weight.
NOTE: It is worth noting that the use of a metal structure such as an airframe as a current return path is not permitted by electrical safety codes in any other situation except aircraft. These safety concerns are discussed in greater detail in footnote 5 of Aircraft Electrical Fire by Alex Paterson
__________________________
COMMENT: Aircraft wires associated with a plethora of diverse
systems and whose power source and voltage are usually different
are currently all bundled together in massive wire looms. (often
involving well over 1000 wires) An explosive arc-tracking event
invariably severely damages surrounding wires taking out unrelated
systems and causing further electrical fires and explosions. TWA
Flight 800 which exploded over New York on 17 July 1996 is thought
to have been caused by low voltage fuel tank quantity wires
shorting out onto adjacent high voltage wires triggering an
explosion in the centre fuel tank.
COMMENT: As above, this requirement cannot be met due to the fact
that the wires from various systems (including emergency power
items) are usually bundled together in massive wire looms
containing up to 1000 wires.
COMMENT: As above, this requirement cannot be met due to the fact
that the wires from various systems (including emergency power
items) are usually bundled together in massive wire looms.
COMMENT: The current generation of bi-metallic circuit breakers
used in aircraft have some serious flaws rendering them inadequate
for the task of being aircraft "circuit protective devices" as
stipulated in FAR 25.1357. Bi-metallic circuit breakers
cannot detect the micro discharges of electrical current
through hairline cracks in the insulation material of aircraft
wire. (a condition known as 'ticking faults') Ticking faults can
eventually lead to a major 'flashover' event in which the
insulation material of the wire suddenly fails leading to a very
high current discharge of energy through the wire to the
surrounding aircraft structure. (i.e. a short circuit) In the case
of KAPTON wire, this flashover event is invariably explosive,
resulting in severe damage to the surrounding wires with
potentially catastrophic results. (e.g. SR111 crash) The situation
can be further exacerbated by the fact that bi-metallic circuit
breakers can actually 'weld' themselves closed due to the
very high heat generated in the circuit breaker during a
flash-over event. Arc-Fault Circuit Interrupter (AFCI) circuit
breakers may be the answer to these problems, however see
footnote
14 above.Source: FAR 25 - Electrical Systems and Equipment: http://www.faa.gov/avr/AFS/FARS/far-25.txt
__________________________
17. B777 ELECTRICAL FIRE DRILL
SMOKE/FUMES/FIRE ELEC
Condition: A concentration of electrical smoke/fumes or fire is identified.OXYGEN MASKS AND SMOKE GOGGLES ON
(If required)CREW COMMUNICATIONS ESTABLISH
(If required)If smoke/fumes or fire source can be determined:
ELECTRICAL POWER (affected equipment) REMOVEIf smoke/fumes or fire is persistent:
Plan to land at the nearest suitable airport.
Source: Boeing B777 Flight Manual
__________________________
18. Engine Failure Light: Considerable thought needs to be put into deciding what parameters and circumstances should trigger the 'ENGINE FAILURE' warning light. It is the author's opinion that only circumstances requiring immediate action (or unambiguous confirmation) should trigger the engine failure warning light. These include:
Items such as low oil pressure, high oil temperature, loss of some thrust without severe vibration, mild engine over temperature, zone over temp associated with a bleed air leak, engine vibration exceeding set thresholds but without significant loss of thrust etc should not trigger the 'Engine Failure' light, but rather illuminate the MASTER CAUTION light and bring up the appropriate advice on the Engine Instrument and Crew Alert System (EICAS) instead.
__________________________
19. 'sine qua non' Definition: (noun) something absolutely indispensable or essential . (Source: Websters Dictionary)
__________________________
20. For more on the KAL B747 Stansted crash of 22 December 1999 see:
__________________________
21. Some pilots carry a stick of Blu-tac in their Nav bags in order to stick a piece of paper over faulty instruments.
__________________________
Copyright © Alex Paterson (2000)
MASTER
INDEX of articles written, posted
online or recommended by Alex Paterson
Alex PATERSON is an Australian airline pilot by profession. He writes articles and advises on issues pertaining to aviation, politics, sociology, the environment, sustainable farming, history, computers, natural health therapies, esoteric teachings and spirituality.
He can be contacted at:
Photograph
of Alex Paterson
The document, 'Aspects of Good Aircraft Design' is the copyright © of the author, Alex Paterson. All rights reserved by the author. Notwithstanding this, the document may be reproduced and disseminated without the express permission of the author so long as reference to the author is made, no alterations are made to the document and no money is charged for it.
Additional Keywords: A320, ADI, Airbus, aircraft accident, aircraft checklist, aircraft crash, aircraft disaster, aircraft design, aircraft electrical fire, aircraft safety, airline pilot, airline safety, angle of attack, autothrottle, aviation safety, Boeing, CAR 224, checklist, cockpit design, emergency, emergency checklist, engine fire handles, FAR 25, FAR25, flight safety, flightsafety, kapton, pilots dispute, pilot traps, RMI, stabilizer trim
